CVE-2023-0750 Yellowbrik PEC-1864 authentication bypass
Attackers can bypass client-side JavaScript authentication to modify device settings, compromising stream integrity and causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-0750?
CVE-2023-0750 is a critical authentication bypass vulnerability in Lynx Technik AG Yellowbrik, published on 6 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Yellobrik PEC-1864 implements authentication checks via javascript in the frontend interface. When the device can be accessed over the network an attacker could bypass authentication.
This would allow an attacker to : - Change the password, resulting in a DOS of the users
- Change the streaming source, compromising the integrity of the stream
- Change the streaming destination, compromising the confidentiality of the stream
This issue affects Yellowbrik: PEC 1864. No patch has been issued by the manufacturer as this model was discontinued.
Which versions are affected by CVE-2023-0750?
It affects 1 product.
Products include Lynx-Technik Yellobrik Pec 1864 Firmware.
How do I fix CVE-2023-0750?
No fix has been published for CVE-2023-0750 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-0750 being exploited?
There is no known exploitation of CVE-2023-0750 in the wild and no public exploit code.
Sources
Also known as GHSA-x7hm-jh97-58mq.